pdf attack - eternal-todo.com

PDF ATTACKA Journey from the Exploit Kit to the Shellcode

Jose Miguel Esparza @EternalTodo

• Jose Miguel Esparza

• Senior Cybercrime Analyst at Fox-IT

– Malware, Botnets, C&Cs, Exploit Kits, …

• Security Researcher at Home ;p

– PDF, NFC, …

• http://eternal-todo.com

• @EternalTodo on Twitter

Who am I

http://eternal-todo.com/




• A Journey from the Exploit Kit to the Shellcode

– Exploit Kits: the source of evil

– PDF basics

– Some basic peepdf commands

– Analyzing PDF exploits

• Extracting and analyzing shellcodes

– Obfuscation of PDF files

Agenda


• Linux distribution

– Libemu / Pylibemu

– V8 / PyV8

• Last peepdf version

– Checkout from the repository or update!

Requirements

Jose Miguel Esparza @peepdf

• Best way to infect a computer

• Effective and fresh exploits

– IE

– Java

– PDF

– Flash

– …

• Average of 6-7 exploits

Exploit Kits: the source of evil



Java 7u11

Java Byte Verify

Java CMM

Java < 7u17

• Most used nowadays

– BlackHole

– Neutrino

– RedKit

– CoolPack

– Styx

– Nuclear

– …


KahuSecurity


• Infection steps

– Visit injected website / Click SPAM link

– Redirection (maybe more than one)

– Obfuscated Javascript

– Plugin detection

– Trying exploits

– Done!



• Traffic Distribution Systems (TDS)

– Country specific attacks

– TDS + Exploit Kits = WIN!



• Analyzing exploit kits

– Avoiding researchers

• Filtering by User-Agent and/or Referer

• Blocking IPs

• One-time infections

• Country filters



• Analyzing obfuscated Javascript code

– The “easy” way

• Automatic tools– Online services

» Wepawet

» JSUNPACK

– Low-interaction honeyclient

» Thug

• You can miss some info




– The traditional way

• Executing different stages of JS code– Beautify the code

– Looking for the eval function

» s/eval/print/

– Hooking the eval function with Javascript engines

• Looking for exploits / shellcodes

• You cannot miss any detail




– The traditional way

• Let’s play ;)



• PDF format?

• PDF structure?

• Objects?

• Filters?

PDF basics


Header

Body

Cross reference table

Trailer


• Body– Sequence of objects

– Object types• Boolean: true false

• Numbers: 123 -98 4. -.002 123.6

• Strings: (hola) <686f6c61>– 68 (h) 6f (o) 6c (l) 61 (a)

• Names: /Type /Filter

• Dictionaries: << /Type /Catalog /Root 1 0 R >>

• Arrays: [ 1.0 (test) <</Length 273>> ]

• Streams

PDF basics


PDF basics


• Object types

– Indirect objects

• Reference: “object_id generation_number R”

PDF basics


• Tree structure References

• Root node

– /Catalog

• If an element isn’t in the downward path from the /Catalog DOES NOT EXIST

PDF basics


• You can use just a text editor!!

PDF basics


“peepdf sounds like the Swiss army knife of PDF security apps”

peepdf

http://peepdf.eternal-todo.com

http://peepdf.eternal-todo.com/




• Characteristics

– Python

– Command line

– Interactive console (colorized)

– Included in REMnux and BackTrack / Kali Linux

peepdf






peepdf






• Characteristics

– Command file option

• Batch / Automation

– XML output

– Easily updated from repository

peepdf






• Why peepdf?

– Support for:

• Encryption

• Object Streams (compressed objects)

• Most used filters

• FlateDecode / LZWDecode Parameters

– Javascript Analysis

– Shellcode emulation

peepdf


• Why peepdf?

– Shows Suspicious Elements

– Shows potential Vulnerabilities

– Powerful Interactive Console

– Easy extraction of objects / JS code / shellcode

– PDF Obfuscation

– Alive project!!

peepdf


• Recent commits

– s/Spidermonkey/PyV8/g

peepdf


• Recent commits

– vtcheck

peepdf


• Commands

– Console

• help

• log

• open

• reset

• quit

• exit

peepdf


• Commands– Showing information

• Whole document– info

– tree

– offsets

– hash

– bytes

– metadata

– changelog

– save_version

– errors

peepdf


• Commands

– Showing information

• Objects– object

– rawobject

– stream

– rawstream

– references

– hash

peepdf


• Commands

– Extracting information

• Output redirection is possible– set

» set output file path_to_my_file

» set output variable myVar

peepdf


• Commands

– Extracting information

• Shell redirection is easier ;)– Files

» stream 6 > stream6_file

» js_code 12 >> pdf_js_code_file

– Variables

» js_unescape variable myVar $> unescaped_sh

» rawstream 5 $>> all_my_rawstreams_var

peepdf


• Commands

– Javascript functions

• js_code

• js_eval

• js_analyse

• js_unescape

• js_join

peepdf


• Commands

– Shellcode emulation

• sctest– pylibemu: libemu wrapper for Python

peepdf


• Commands– Modification / Creation

• modify• filters• decode• encode• encode_strings• embed• encrypt• malformed_output• create• save

peepdf


• Commands

– Misc

• set

• search

• show

• xor

• xor_search

peepdf


• How to identify malicious files– Suspicious elements

• /Action

• /OpenAction

• /AA

• /AcroForm

• /Names

• /JavaScript

• /EmbeddedFile

• Known vulnerabilities

Analyzing PDF exploits


• Most used vulnerabilities

– LibTiff (TIFF images)

– Collab.collectEmailInfo

– Collab.getIcon

– Doc.media.newPlayer

– …



• How to identify malicious files

– Obfuscation

• Strange codification in objects

• Encryption

• Malformed objects

• Embeded PDFs

• Javascript




– Patterns

• One page without content

• Big objects

• Gaps between objects (offsets)

• Strange structure

• Characteristic strings– Metadata

– Tools




– Malformed documents

• Headers

• Objects Tags



• Practicing all the theory

• Not a sample exploit, a real one

• Extracting the interesting parts

• Extracting the shellcode

• Analyzing the shellcode

Analyzing real exploits


• Playing with real exploits

Analyzing real exploits


• Some developments based on peepdf

– SWF Mastah (Brandon Dixon)

Using peepdf as a library


• Remove characteristic strings• Split up Javascript code (/Names)• If the code is in:

– String octal encoding (\143\172)– Stream filters (not usual, parameters)

• Compress (object streams)• Encrypt (default password)• Malform (endobj, header)• Nest PDFs

PDF obfuscation

THANKS!!

Jose Miguel Esparzajesparza AT eternal-todo.com

http://eternal-todo.com

@EternalTodo

pdf attack - eternal-todo.com

Documents